Harm, Legality, and the Investigator

Before publishing, list every person the finding touches, including those merely adjacent, and ask what happens to each if you are wrong.

In 2013 a crowd on a message board named a missing student as a bombing suspect on nothing but a resemblance to a released photograph. He had died weeks earlier.

His family was hounded while the claim spread through social media and into mainstream reporting, and the platform apologized afterward. Afterward is the operative word: there is no correction that reaches everyone who saw the accusation.

Minimize identifying data. Home addresses, workplaces, family members and children do not belong in a finding unless they are the finding. Publishing them is doxxing regardless of whether the subject turns out to be guilty.

Three legal lines are worth knowing before you are near them. Using someone else's credentials to enter a system you are shut out of is a computer-crime exposure. A 2021 Supreme Court decision narrowed the offense so that misusing data you are authorized to see is generally not federal computer crime, but it did not touch unauthorized entry.

Obtaining records by pretending to be someone entitled to them — pretexting — is separately prohibited for financial records and, after a 2006 corporate spying scandal, for telephone records. And recording consent is one-party in some jurisdictions and all-party in others, so check every participant's jurisdiction, not only your own.

Then offer a right of reply. Put the specific allegations to the subject before publishing, record the response, and record a refusal as a refusal. It is both the fair thing and the most efficient error-check available to you.

Last, check yourself. Sustained exposure to violent or distressing material has documented effects on the people who do this work. Exposure limits, working hours and support are part of the method, not an admission of weakness.